The jstree package is vulnerable to Cross-Site Scripting (XSS)

[Idriskp1]

We are using SonaType for scanning binaries that we use.

The jstree package is vulnerable to Cross-Site Scripting (XSS). The get_node() function in jstree.js passes the user input to JQuery in an unsafe manner. A remote attacker can exploit this vulnerability to execute arbitrary JavaScript in a victim's browser context.

fd63728762c93892f506e158be58a0d98034ccff.zipKarmabunny-sprout3-fd63728/src/media/js/jstree.min.js( , 3.3.6)

The application is vulnerable by using this component.

we are using vakata-jstree-3.3.16

Is there a version of this component that is not vulnerable to this specific issue?

Thanks
Kind regards
Idris